When someone steals your identity and opens accounts in your name, the damage to your credit can be swift and severe. But the FCRA provides an expedited process for identity theft victims that goes beyond the standard 30-day dispute — including the right to block fraudulent information from your file entirely.
Step 1: File an Identity Theft Report at IdentityTheft.gov
Go to IdentityTheft.gov (operated by the FTC) and report the theft. The site generates an official FTC Identity Theft Report, which is your legal documentation for disputing fraudulent accounts. This report is critical — it triggers enhanced protections under the FCRA that a standard dispute letter alone does not.
Step 2: Place a Fraud Alert or Credit Freeze
A fraud alert (free, lasts 1 year, renewable) requires lenders to verify your identity before opening new accounts. An extended fraud alert (free, lasts 7 years) is available to identity theft victims with an FTC report. A credit freeze is the strongest protection — it blocks all new credit inquiries entirely until you lift it.
Step 3: Request a Block of Fraudulent Information Under FCRA § 605B
Under FCRA § 605B, bureaus must block information resulting from identity theft within 4 business days of receiving your written request, your identity theft report, and proof of your identity. This is faster and stronger than a standard § 611 dispute.
Step 4: Send a Written Dispute to Each Bureau
Send a letter to each bureau that is reporting the fraudulent item. Include your FTC Identity Theft Report, a copy of your government-issued ID, and a list of each fraudulent account with account numbers and the name of the creditor.
Step 5: Notify the Creditors Directly
Contact each creditor whose account was fraudulently opened. Ask them to close the account and mark it as fraud in their records. Under the FCRA, creditors are prohibited from selling or transferring debt they have been notified was the result of identity theft.
Ongoing Monitoring
After resolving identity theft disputes, monitor your credit reports closely for several months. Fraudulent activity sometimes recurs if the underlying information theft isn't resolved.